Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The salt doesn't have to be plain-text, that's an implementation detail in the common password hashing algorithms for obvious reasons. The requirement was that the hash should be non-reversible. Store the salt in a (http-only) session cookie and concatenate it to the IP before the hashing rounds. Put your entropy in the salt and any brute-force attempt is theoretical. For every session you need to compute the exact combination of IP + salt (which isn't even known to the server).


At that point, what value does the salted+hashed IP address give you over a randomly generated number (say, a UUID) per session?


None, I'm not arguing for the solution. Proxying through a PHP script just to keep using Google Analytics is overkill when private self-hosted solutions exist. I'm simply showing how you can anonymize IPs even from yourself, if the goal is to anonymize from only Google and not the server it could be useful across sessions.

The solution being overkill does not mean my first comment 'That's why you use a salt, which is what I assume is meant by "non-reversibly"' is wrong.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: